YesWiki EUVD-2026-91465

Exploitation requires network reachability to the YesWiki page-edit preview endpoint, which per the description is accessible to unauthenticated attackers (PR:N/UI:N) on affected versions before 4.6.7 - no login, special configuration, or user interaction is needed. The specific trigger is a small crafted request body composed of bracket characters that drives the O(n^2) markdown-link regex in the wakka.php formatter. The main limiting factor is deployment exposure: the preview endpoint must be internet- or network-accessible, and impact is confined to availability (PHP-FPM worker/CPU exhaustion) with no data disclosure or modification; instances behind authentication gateways, rate limiting, or WAF request-size/pattern filtering substantially reduce practical risk.

This is a genuine but moderate-priority issue, best understood as a resource-exhaustion DoS rather than a system-compromise vulnerability. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, and impact is correctly scoped to availability only (VA:L; VC:N/VI:N) - consistent with the CWE-1333 inefficient-regex-complexity (ReDoS) classification and the O(n^2) markdown-link parsing described. The score of 6.9 (medium) accurately reflects that confidentiality and integrity are untouched. No EPSS score, KEV listing, or POC flag was provided in the input, so exploitation signals are limited: there is no public exploit identified at time of analysis and no evidence of active exploitation. The low barrier (small crafted request to an unauthenticated endpoint) means the EASE of exploitation is high even though the IMPACT ceiling is bounded to service degradation of a single YesWiki instance. Net: patch promptly on internet-exposed instances because unauthenticated low-effort DoS is trivially automatable, but this is not a critical compromise vector. Note the impact is rated only VA:L, suggesting partial/recoverable availability loss (worker pool saturation) rather than permanent outage.

An unauthenticated attacker sends a small HTTP request to the YesWiki page-edit preview endpoint containing a short body of densely nested bracket characters. The vulnerable O(n^2) markdown-link regex in wakka.php consumes disproportionate CPU time, pinning a PHP-FPM worker; repeating the request across the pool saturates all workers and renders the site unresponsive to legitimate users. No public exploit code is identified at time of analysis, but the technique is straightforward to reproduce from the description.